Wireshark · Wireshark-users: Re: [Wireshark-users] Question on Decoding packet with insertedproprietary header

["Anders Broman" <a.broman@xxxxxxxxx>]

Hi,
Do the modified packet has it's own Ethertype?
If so you could make a dissector for that ethertype that dissects
the 34 byte header before passing the tvb to the IP dissector(it doesn't
necessarily have to interpret the header).
Best regards
Anders

-----Ursprungligt meddelande-----
Från: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] För Small, James
Skickat: den 13 mars 2007 19:13
Till: Community support list for Wireshark
Ämne: [Wireshark-users] Question on Decoding packet with insertedproprietary
header

Hello,

I am dealing with packets that are modified by a vendor device.  The
packets are standard Ethernet frames with IP.  Once the frames/packets
traverse the Vendor device, a new proprietary header is inserted between
the Ethernet header and the IP header.

So, in a standard IP/Ethernet packet, my IP offset is 0x08.
In the modified IP/Ethernet packet, my IP offset is 0x30.

The modified IP/Ethernet packet looks like this:
Ethernet Header
Proprietary Header - 34 bytes
IP Header and the rest of the packet

Using Wireshark, is there a way to start the IP decode at a/the
specified offset?


In this case I don't really need to decode the vendor header, I just
need to see the IP header and after.

Any feedback greatly appreciated!

Thanks,
  --Jim

_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users